pq_crypto 0.6.4 → 0.6.6

data/ext/pqcrypto/vendor/mldsa-native/mldsa/src/common.h

@@ -71,7 +71,7 @@
 #define MLD_NAMESPACE_KL(s) MLD_CONCAT(MLD_NAMESPACE_PREFIX_KL, s)
 
 /* On Apple platforms, we need to emit leading underscore
- * in front of assembly symbols. We thus introducee a separate
+ * in front of assembly symbols. We thus introduce a separate
  * namespace wrapper for ASM symbols. */
 #if !defined(__APPLE__)
 #define MLD_ASM_NAMESPACE(sym) MLD_NAMESPACE(sym)
@@ -129,15 +129,19 @@
 #endif
 
 #if defined(MLD_CONFIG_NO_RANDOMIZED_API) && defined(MLD_CONFIG_KEYGEN_PCT)
-#error Bad configuration: MLD_CONFIG_NO_RANDOMIZED_API is incompatible with MLD_CONFIG_KEYGEN_PCT as the current PCT implementation requires crypto_sign_signature()
+#error Bad configuration: MLD_CONFIG_NO_RANDOMIZED_API is incompatible with MLD_CONFIG_KEYGEN_PCT as the current PCT implementation requires signature()
 #endif
 
 #if defined(MLD_CONFIG_NO_SIGN_API) && defined(MLD_CONFIG_KEYGEN_PCT)
-#error Bad configuration: MLD_CONFIG_NO_SIGN_API is incompatible with MLD_CONFIG_KEYGEN_PCT as the current PCT implementation requires crypto_sign_signature()
+#error Bad configuration: MLD_CONFIG_NO_SIGN_API is incompatible with MLD_CONFIG_KEYGEN_PCT as the current PCT implementation requires signature()
 #endif
 
 #if defined(MLD_CONFIG_NO_VERIFY_API) && defined(MLD_CONFIG_KEYGEN_PCT)
-#error Bad configuration: MLD_CONFIG_NO_VERIFY_API is incompatible with MLD_CONFIG_KEYGEN_PCT as the current PCT implementation requires crypto_sign_verify()
+#error Bad configuration: MLD_CONFIG_NO_VERIFY_API is incompatible with MLD_CONFIG_KEYGEN_PCT as the current PCT implementation requires verify()
+#endif
+
+#if defined(MLD_CONFIG_CORE_API_ONLY) && defined(MLD_CONFIG_KEYGEN_PCT)
+#error Bad configuration: MLD_CONFIG_CORE_API_ONLY is incompatible with MLD_CONFIG_KEYGEN_PCT as the current PCT implementation requires signature() and verify()
 #endif
 
 #if defined(MLD_CONFIG_USE_NATIVE_BACKEND_ARITH)
@@ -202,77 +206,31 @@
 #error Bad configuration: MLD_CONFIG_CUSTOM_ALLOC_FREE must be set together with MLD_CUSTOM_ALLOC and MLD_CUSTOM_FREE
 #endif
 
-/*
- * If the integration wants to provide a context parameter for use in
- * platform-specific hooks, then it should define this parameter.
- *
- * The MLD_CONTEXT_PARAMETERS_n macros are intended to be used with macros
- * defining the function names and expand to either pass or discard the context
- * argument as required by the current build.  If there is no context parameter
- * requested then these are removed from the prototypes and from all calls.
- */
-#ifdef MLD_CONFIG_CONTEXT_PARAMETER
-#define MLD_CONTEXT_PARAMETERS_0(context) (context)
-#define MLD_CONTEXT_PARAMETERS_1(arg0, context) (arg0, context)
-#define MLD_CONTEXT_PARAMETERS_2(arg0, arg1, context) (arg0, arg1, context)
-#define MLD_CONTEXT_PARAMETERS_3(arg0, arg1, arg2, context) \
-  (arg0, arg1, arg2, context)
-#define MLD_CONTEXT_PARAMETERS_4(arg0, arg1, arg2, arg3, context) \
-  (arg0, arg1, arg2, arg3, context)
-#define MLD_CONTEXT_PARAMETERS_5(arg0, arg1, arg2, arg3, arg4, context) \
-  (arg0, arg1, arg2, arg3, arg4, context)
-#define MLD_CONTEXT_PARAMETERS_6(arg0, arg1, arg2, arg3, arg4, arg5, context) \
-  (arg0, arg1, arg2, arg3, arg4, arg5, context)
-#define MLD_CONTEXT_PARAMETERS_7(arg0, arg1, arg2, arg3, arg4, arg5, arg6, \
-                                 context)                                  \
-  (arg0, arg1, arg2, arg3, arg4, arg5, arg6, context)
-#define MLD_CONTEXT_PARAMETERS_8(arg0, arg1, arg2, arg3, arg4, arg5, arg6, \
-                                 arg7, context)                            \
-  (arg0, arg1, arg2, arg3, arg4, arg5, arg6, arg7, context)
-#define MLD_CONTEXT_PARAMETERS_9(arg0, arg1, arg2, arg3, arg4, arg5, arg6, \
-                                 arg7, arg8, context)                      \
-  (arg0, arg1, arg2, arg3, arg4, arg5, arg6, arg7, arg8, context)
-#else /* MLD_CONFIG_CONTEXT_PARAMETER */
-#define MLD_CONTEXT_PARAMETERS_0(context) ()
-#define MLD_CONTEXT_PARAMETERS_1(arg0, context) (arg0)
-#define MLD_CONTEXT_PARAMETERS_2(arg0, arg1, context) (arg0, arg1)
-#define MLD_CONTEXT_PARAMETERS_3(arg0, arg1, arg2, context) (arg0, arg1, arg2)
-#define MLD_CONTEXT_PARAMETERS_4(arg0, arg1, arg2, arg3, context) \
-  (arg0, arg1, arg2, arg3)
-#define MLD_CONTEXT_PARAMETERS_5(arg0, arg1, arg2, arg3, arg4, context) \
-  (arg0, arg1, arg2, arg3, arg4)
-#define MLD_CONTEXT_PARAMETERS_6(arg0, arg1, arg2, arg3, arg4, arg5, context) \
-  (arg0, arg1, arg2, arg3, arg4, arg5)
-#define MLD_CONTEXT_PARAMETERS_7(arg0, arg1, arg2, arg3, arg4, arg5, arg6, \
-                                 context)                                  \
-  (arg0, arg1, arg2, arg3, arg4, arg5, arg6)
-#define MLD_CONTEXT_PARAMETERS_8(arg0, arg1, arg2, arg3, arg4, arg5, arg6, \
-                                 arg7, context)                            \
-  (arg0, arg1, arg2, arg3, arg4, arg5, arg6, arg7)
-#define MLD_CONTEXT_PARAMETERS_9(arg0, arg1, arg2, arg3, arg4, arg5, arg6, \
-                                 arg7, arg8, context)                      \
-  (arg0, arg1, arg2, arg3, arg4, arg5, arg6, arg7, arg8)
-#endif /* !MLD_CONFIG_CONTEXT_PARAMETER */
-
-#if defined(MLD_CONFIG_CONTEXT_PARAMETER_TYPE) != \
-    defined(MLD_CONFIG_CONTEXT_PARAMETER)
-#error MLD_CONFIG_CONTEXT_PARAMETER_TYPE must be defined if and only if MLD_CONFIG_CONTEXT_PARAMETER is defined
-#endif
+/* Context-parameter machinery (MLD_CONTEXT_PARAMETERS_n and related config
+ * checks). Kept in a separate, level-generic header for readability; included
+ * here so it is available to the allocation macros below and to all consumers
+ * of common.h. */
+#include "context.h"
 
 #if !defined(MLD_CONFIG_CUSTOM_ALLOC_FREE)
 /* Default: stack allocation */
 
+/* This is a declaration macro, not an expression macro: T is a type and v is
+ * a declarator, neither of which can be wrapped in parentheses. The
+ * bugprone-macro-parentheses diagnostic is therefore a false positive here. */
 #define MLD_ALLOC(v, T, N, context) \
   MLD_ALIGN T mld_alloc_##v[N];     \
-  T *v = mld_alloc_##v
+  T *v = mld_alloc_##v /* NOLINT(bugprone-macro-parentheses) */
 
-/* TODO: This leads to a circular dependency between common and ct.h
- * It just works out before we're at the end of the file, but it's still
- * prone to issues in the future. */
-#include "ct.h"
+/* The MLD_FREE macro body references mld_zeroize(), which is declared in
+ * ct.h. We deliberately do NOT include ct.h here: doing so would create a
+ * circular dependency (ct.h includes common.h), and common.h itself never
+ * calls mld_zeroize() -- only the macro expansion does. Each translation
+ * unit that uses MLD_FREE therefore includes ct.h directly. */
 #define MLD_FREE(v, T, N, context)                     \
   do                                                   \
   {                                                    \
+    MLD_CONTEXT_UNUSED(context);                       \
     mld_zeroize(mld_alloc_##v, sizeof(mld_alloc_##v)); \
     (v) = NULL;                                        \
   } while (0)
@@ -304,28 +262,38 @@
 
 /****************************** Error codes ***********************************/
 
-/* Generic failure condition */
-#define MLD_ERR_FAIL -1
+/* Generic failure condition, reserved for failures not covered by a more
+ * specific error code. */
+#define MLD_ERR_FAIL (-1)
 /* An allocation failed. This can only happen if MLD_CONFIG_CUSTOM_ALLOC_FREE
  * is defined and the provided MLD_CUSTOM_ALLOC can fail. */
-#define MLD_ERR_OUT_OF_MEMORY -2
-/* An rng failure occured. Might be due to insufficient entropy or
+#define MLD_ERR_OUT_OF_MEMORY (-2)
+/* An RNG failure occurred. Might be due to insufficient entropy or
  * system misconfiguration. */
-#define MLD_ERR_RNG_FAIL -3
+#define MLD_ERR_RNG_FAIL (-3)
 /* The signing rejection-sampling loop exceeded
  * MLD_CONFIG_MAX_SIGNING_ATTEMPTS iterations without producing a valid
- * signature. With a FIPS 204 Appendix C compliant bound (>= 814) this
+ * signature. With a FIPS 204 Appendix C compliant bound (>= 821) this
  * has probability < 2^-256. */
-#define MLD_ERR_SIGN_ATTEMPTS_EXHAUSTED -4
-
-/* Disjunction over the full set of MLD_ERR_XXX failure codes.
- *
- * Intended for use in top-level `ensures` clauses that admit every
- * possible error. Narrower contracts should enumerate only the
- * specific errors they can actually return. */
-#define MLD_ANY_ERROR(err)                                    \
-  ((err) == MLD_ERR_FAIL || (err) == MLD_ERR_OUT_OF_MEMORY || \
-   (err) == MLD_ERR_RNG_FAIL || (err) == MLD_ERR_SIGN_ATTEMPTS_EXHAUSTED)
+#define MLD_ERR_SIGN_ATTEMPTS_EXHAUSTED (-4)
+/* Signing was paused before completing, at the request of a caller-provided
+ * MLD_CONFIG_SIGN_HOOK_ATTEMPT hook (see mldsa_native_config.h). The caller
+ * resumes by re-invoking signing with the same inputs; the attempt hook,
+ * together with MLD_CONFIG_SIGN_HOOK_RESUME, decides where to continue. */
+#define MLD_ERR_SIGNING_PAUSED (-5)
+/* Signature verification failed: the signature is not valid for the given
+ * message and public key. Returned by the verification API. */
+#define MLD_ERR_INVALID_SIGNATURE (-6)
+/* Secret key validation failed: the secret key is malformed or internally
+ * inconsistent. Returned by pk_from_sk. */
+#define MLD_ERR_INVALID_KEY (-7)
+/* The Pairwise Consistency Test failed. Only possible when
+ * MLD_CONFIG_KEYGEN_PCT is enabled; signals that the freshly generated key
+ * pair failed its sign/verify self-test. */
+#define MLD_ERR_PCT_FAIL (-8)
+/* An argument was invalid, e.g. an unsupported pre-hash algorithm or a context
+ * string longer than 255 bytes. */
+#define MLD_ERR_INVALID_ARG (-9)
 
 
 #endif /* !__ASSEMBLER__ */

data/ext/pqcrypto/vendor/mldsa-native/mldsa/src/context.h

@@ -0,0 +1,152 @@
+/*
+ * Copyright (c) The mldsa-native project authors
+ * SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT
+ */
+#ifndef MLD_CONTEXT_H
+#define MLD_CONTEXT_H
+
+/* This header is included by common.h once the configuration has been pulled
+ * in; it is not meant to be included directly. */
+#if !defined(__ASSEMBLER__)
+
+#include <stdint.h>
+#include "cbmc.h"
+#include "sys.h"
+
+/*
+ * If the integration wants to provide a context parameter for use in
+ * platform-specific hooks, then it should define this parameter.
+ *
+ * The MLD_CONTEXT_PARAMETERS_n macros are intended to be used with macros
+ * defining the function names and expand to either pass or discard the context
+ * argument as required by the current build.  If there is no context parameter
+ * requested then these are removed from the prototypes and from all calls.
+ */
+#ifdef MLD_CONFIG_CONTEXT_PARAMETER
+#define MLD_CONTEXT_PARAMETERS_0(context) (context)
+#define MLD_CONTEXT_PARAMETERS_1(arg0, context) (arg0, context)
+#define MLD_CONTEXT_PARAMETERS_2(arg0, arg1, context) (arg0, arg1, context)
+#define MLD_CONTEXT_PARAMETERS_3(arg0, arg1, arg2, context) \
+  (arg0, arg1, arg2, context)
+#define MLD_CONTEXT_PARAMETERS_4(arg0, arg1, arg2, arg3, context) \
+  (arg0, arg1, arg2, arg3, context)
+#define MLD_CONTEXT_PARAMETERS_5(arg0, arg1, arg2, arg3, arg4, context) \
+  (arg0, arg1, arg2, arg3, arg4, context)
+#define MLD_CONTEXT_PARAMETERS_6(arg0, arg1, arg2, arg3, arg4, arg5, context) \
+  (arg0, arg1, arg2, arg3, arg4, arg5, context)
+#define MLD_CONTEXT_PARAMETERS_7(arg0, arg1, arg2, arg3, arg4, arg5, arg6, \
+                                 context)                                  \
+  (arg0, arg1, arg2, arg3, arg4, arg5, arg6, context)
+#define MLD_CONTEXT_PARAMETERS_8(arg0, arg1, arg2, arg3, arg4, arg5, arg6, \
+                                 arg7, context)                            \
+  (arg0, arg1, arg2, arg3, arg4, arg5, arg6, arg7, context)
+#define MLD_CONTEXT_PARAMETERS_9(arg0, arg1, arg2, arg3, arg4, arg5, arg6, \
+                                 arg7, arg8, context)                      \
+  (arg0, arg1, arg2, arg3, arg4, arg5, arg6, arg7, arg8, context)
+#else /* MLD_CONFIG_CONTEXT_PARAMETER */
+#define MLD_CONTEXT_PARAMETERS_0(context) ()
+#define MLD_CONTEXT_PARAMETERS_1(arg0, context) (arg0)
+#define MLD_CONTEXT_PARAMETERS_2(arg0, arg1, context) (arg0, arg1)
+#define MLD_CONTEXT_PARAMETERS_3(arg0, arg1, arg2, context) (arg0, arg1, arg2)
+#define MLD_CONTEXT_PARAMETERS_4(arg0, arg1, arg2, arg3, context) \
+  (arg0, arg1, arg2, arg3)
+#define MLD_CONTEXT_PARAMETERS_5(arg0, arg1, arg2, arg3, arg4, context) \
+  (arg0, arg1, arg2, arg3, arg4)
+#define MLD_CONTEXT_PARAMETERS_6(arg0, arg1, arg2, arg3, arg4, arg5, context) \
+  (arg0, arg1, arg2, arg3, arg4, arg5)
+#define MLD_CONTEXT_PARAMETERS_7(arg0, arg1, arg2, arg3, arg4, arg5, arg6, \
+                                 context)                                  \
+  (arg0, arg1, arg2, arg3, arg4, arg5, arg6)
+#define MLD_CONTEXT_PARAMETERS_8(arg0, arg1, arg2, arg3, arg4, arg5, arg6, \
+                                 arg7, context)                            \
+  (arg0, arg1, arg2, arg3, arg4, arg5, arg6, arg7)
+#define MLD_CONTEXT_PARAMETERS_9(arg0, arg1, arg2, arg3, arg4, arg5, arg6, \
+                                 arg7, arg8, context)                      \
+  (arg0, arg1, arg2, arg3, arg4, arg5, arg6, arg7, arg8)
+#endif /* !MLD_CONFIG_CONTEXT_PARAMETER */
+
+/* Consume a context parameter carried only for the integration's benefit,
+ * avoiding -Wunused-parameter; expands to nothing when no context is
+ * configured. */
+#if defined(MLD_CONFIG_CONTEXT_PARAMETER)
+#define MLD_CONTEXT_UNUSED(context) ((void)(context))
+#else
+#define MLD_CONTEXT_UNUSED(context) ((void)0)
+#endif
+
+#if defined(MLD_CONFIG_CONTEXT_PARAMETER_TYPE) != \
+    defined(MLD_CONFIG_CONTEXT_PARAMETER)
+#error MLD_CONFIG_CONTEXT_PARAMETER_TYPE must be defined if and only if MLD_CONFIG_CONTEXT_PARAMETER is defined
+#endif
+
+/* The signing hooks tie into the rejection-sampling loop. A pausing attempt
+ * hook only reproduces the uninterrupted signature if the randomness is fixed
+ * across calls, and thus requires the deterministic API.
+ * For now we impose that requirement on all three hooks uniformly: enabling any
+ * of them requires MLD_CONFIG_NO_RANDOMIZED_API. This also rules out
+ * MLD_CONFIG_KEYGEN_PCT (whose PCT needs the randomized signature(), see
+ * common.h).
+ *
+ * A logging-only use (attempt always returns 0; resume/finish merely observe)
+ * would be safe with the randomized API too, but the restriction is applied
+ * uniformly for now. */
+#if (defined(MLD_CONFIG_SIGN_HOOK_RESUME) ||  \
+     defined(MLD_CONFIG_SIGN_HOOK_ATTEMPT) || \
+     defined(MLD_CONFIG_SIGN_HOOK_FINISH)) && \
+    !defined(MLD_CONFIG_NO_RANDOMIZED_API)
+#error Signing hooks (MLD_CONFIG_SIGN_HOOK_RESUME / _ATTEMPT / _FINISH) require MLD_CONFIG_NO_RANDOMIZED_API
+#endif /* (MLD_CONFIG_SIGN_HOOK_RESUME || MLD_CONFIG_SIGN_HOOK_ATTEMPT || \
+          MLD_CONFIG_SIGN_HOOK_FINISH) && !MLD_CONFIG_NO_RANDOMIZED_API */
+
+/* Signing hooks (MLD_CONFIG_SIGN_HOOK_RESUME / _ATTEMPT / _FINISH; documented
+ * in mldsa_native_config.h). The following macros route the call sites to
+ * mld_sign_hook_*, appending or dropping the context argument; each unset hook
+ * uses the dummy below. */
+#define mld_sign_resume mld_sign_hook_resume MLD_CONTEXT_PARAMETERS_0
+#define mld_sign_attempt mld_sign_hook_attempt MLD_CONTEXT_PARAMETERS_1
+#define mld_sign_finish mld_sign_hook_finish MLD_CONTEXT_PARAMETERS_1
+
+/* We don't use mld_sign_resume here because MLD_CONTEXT_PARAMETERS_0 is
+ * unsuitable for function declarations: it misses `void` as the placeholder
+ * argument. */
+#if !defined(MLD_CONFIG_SIGN_HOOK_RESUME)
+MLD_MUST_CHECK_RETURN_VALUE
+static MLD_INLINE uint16_t mld_sign_hook_resume(
+#if defined(MLD_CONFIG_CONTEXT_PARAMETER)
+    MLD_CONFIG_CONTEXT_PARAMETER_TYPE context
+#else
+    void
+#endif
+)
+__contract__(assigns() ensures(1))
+{
+  MLD_CONTEXT_UNUSED(context);
+  return 0;
+}
+#endif /* !MLD_CONFIG_SIGN_HOOK_RESUME */
+
+#if !defined(MLD_CONFIG_SIGN_HOOK_ATTEMPT)
+MLD_MUST_CHECK_RETURN_VALUE
+static MLD_INLINE int mld_sign_attempt(
+    uint16_t attempt, MLD_CONFIG_CONTEXT_PARAMETER_TYPE context)
+__contract__(assigns() ensures(1))
+{
+  ((void)attempt);
+  MLD_CONTEXT_UNUSED(context);
+  return 0;
+}
+#endif /* !MLD_CONFIG_SIGN_HOOK_ATTEMPT */
+
+#if !defined(MLD_CONFIG_SIGN_HOOK_FINISH)
+static MLD_INLINE void mld_sign_finish(
+    uint16_t attempt, MLD_CONFIG_CONTEXT_PARAMETER_TYPE context)
+__contract__(assigns() ensures(1))
+{
+  ((void)attempt);
+  MLD_CONTEXT_UNUSED(context);
+}
+#endif /* !MLD_CONFIG_SIGN_HOOK_FINISH */
+
+#endif /* !__ASSEMBLER__ */
+
+#endif /* !MLD_CONTEXT_H */

data/ext/pqcrypto/vendor/mldsa-native/mldsa/src/ct.h

@@ -151,7 +151,7 @@ __contract__(ensures(return_value == b))
  * @return For uint32_t x, the unique y in int32_t so that x == y mod 2^32.
  *         Concretely:
  *         - x <  2^31: returns x
- *         - x >= 2^31: returns x - 2^31
+ *         - x >= 2^31: returns x - 2^32
  */
 MLD_MUST_CHECK_RETURN_VALUE
 static MLD_ALWAYS_INLINE int32_t mld_cast_uint32_to_int32(uint32_t x)
@@ -230,6 +230,12 @@ static MLD_INLINE uint32_t mld_ct_cmask_nonzero_u32(uint32_t x)
 __contract__(ensures(return_value == ((x == 0) ? 0 : 0xFFFFFFFF)))
 {
   int64_t tmp = mld_value_barrier_i64(-((int64_t)x));
+  /*
+   * PORTABILITY: Right-shift on a signed integer is
+   * implementation-defined for negative left argument.
+   * Here, we assume it's sign-preserving "arithmetic" shift right.
+   * See (C99 6.5.7 (5))
+   */
   tmp >>= 32;
   return mld_cast_int64_to_uint32(tmp);
 }
@@ -259,6 +265,12 @@ __contract__(
 )
 {
   int64_t tmp = mld_value_barrier_i64((int64_t)x);
+  /*
+   * PORTABILITY: Right-shift on a signed integer is
+   * implementation-defined for negative left argument.
+   * Here, we assume it's sign-preserving "arithmetic" shift right.
+   * See (C99 6.5.7 (5))
+   */
   tmp >>= 31;
   return mld_cast_int64_to_uint32(tmp);
 }
@@ -333,28 +345,29 @@ __contract__(
 #if !defined(MLD_CONFIG_CUSTOM_ZEROIZE)
 #if defined(MLD_SYS_WINDOWS)
 #include <windows.h>
+#elif !defined(MLD_HAVE_INLINE_ASM)
+#error No plausibly-secure implementation of mld_zeroize available. Please provide your own using MLD_CONFIG_CUSTOM_ZEROIZE.
+#endif
+
 static MLD_INLINE void mld_zeroize(void *ptr, size_t len)
 __contract__(
+  requires(len <= UINT32_MAX)
   requires(memory_no_alias(ptr, len))
-  assigns(memory_slice(ptr, len))) { SecureZeroMemory(ptr, len); }
-#elif defined(MLD_HAVE_INLINE_ASM)
-#include <string.h>
-static MLD_INLINE void mld_zeroize(void *ptr, size_t len)
-__contract__(
-  requires(memory_no_alias(ptr, len))
-  assigns(memory_slice(ptr, len)))
+  assigns(memory_slice(ptr, len))
+  ensures(array_zeroized_u8((uint8_t *)ptr, len)))
 {
-  memset(ptr, 0, len);
+#if defined(MLD_SYS_WINDOWS)
+  SecureZeroMemory(ptr, len);
+#else
+  mld_memset(ptr, 0, len);
   /* This follows OpenSSL and seems sufficient to prevent the compiler
    * from optimizing away the memset.
    *
    * If there was a reliable way to detect availability of memset_s(),
    * that would be preferred. */
   __asm__ __volatile__("" : : "r"(ptr) : "memory");
+#endif /* !MLD_SYS_WINDOWS */
 }
-#else /* !MLD_SYS_WINDOWS && MLD_HAVE_INLINE_ASM */
-#error No plausibly-secure implementation of mld_zeroize available. Please provide your own using MLD_CONFIG_CUSTOM_ZEROIZE.
-#endif /* !MLD_SYS_WINDOWS && !MLD_HAVE_INLINE_ASM */
 #endif /* !MLD_CONFIG_CUSTOM_ZEROIZE */
 
 #endif /* !MLD_CT_H */

data/ext/pqcrypto/vendor/mldsa-native/mldsa/src/debug.c

@@ -19,6 +19,7 @@
 
 #define MLD_DEBUG_ERROR_HEADER "[ERROR:%s:%04d] "
 
+MLD_INTERNAL_API
 void mld_debug_check_assert(const char *file, int line, const int val)
 {
   if (val == 0)
@@ -29,6 +30,7 @@ void mld_debug_check_assert(const char *file, int line, const int val)
   }
 }
 
+MLD_INTERNAL_API
 void mld_debug_check_bounds(const char *file, int line, const int32_t *ptr,
                             unsigned len, int64_t lower_bound_exclusive,
                             int64_t upper_bound_exclusive)

data/ext/pqcrypto/vendor/mldsa-native/mldsa/src/debug.h

@@ -19,6 +19,7 @@
  * @param val  Value asserted to be non-zero.
  */
 #define mld_debug_check_assert MLD_NAMESPACE(mldsa_debug_assert)
+MLD_INTERNAL_API
 void mld_debug_check_assert(const char *file, int line, const int val);
 
 /**
@@ -34,6 +35,7 @@ void mld_debug_check_assert(const char *file, int line, const int val);
  * @param     upper_bound_exclusive Exclusive upper bound.
  */
 #define mld_debug_check_bounds MLD_NAMESPACE(mldsa_debug_check_bounds)
+MLD_INTERNAL_API
 void mld_debug_check_bounds(const char *file, int line, const int32_t *ptr,
                             unsigned len, int64_t lower_bound_exclusive,
                             int64_t upper_bound_exclusive);

data/ext/pqcrypto/vendor/mldsa-native/mldsa/src/fips202/fips202x4.c

@@ -24,7 +24,7 @@
 
 #if !defined(MLD_CONFIG_NO_KEYPAIR_API) || !defined(MLD_CONFIG_REDUCE_RAM) || \
     defined(MLD_UNIT_TEST)
-static void mld_keccak_absorb_once_x4(uint64_t *s, uint32_t r,
+static void mld_keccak_absorb_once_x4(uint64_t *s, unsigned r,
                                       const uint8_t *in0, const uint8_t *in1,
                                       const uint8_t *in2, const uint8_t *in3,
                                       size_t inlen, uint8_t p)
@@ -81,7 +81,7 @@ __contract__(
 
 static void mld_keccak_squeezeblocks_x4(uint8_t *out0, uint8_t *out1,
                                         uint8_t *out2, uint8_t *out3,
-                                        size_t nblocks, uint64_t *s, uint32_t r)
+                                        size_t nblocks, uint64_t *s, unsigned r)
 __contract__(
     requires(r <= sizeof(uint64_t) * MLD_KECCAK_LANES)
     requires(nblocks <= 8 /* somewhat arbitrary bound */)

data/ext/pqcrypto/vendor/mldsa-native/mldsa/src/fips202/keccakf1600.c

@@ -27,13 +27,11 @@
  * implementation @[supercop, crypto_hash/keccakc512/simple/]
  * by Ronny Van Keer, and the public domain @[tweetfips] implementation. */
 
-#include <assert.h>
-
 #include "keccakf1600.h"
 #if !defined(MLD_CONFIG_MULTILEVEL_NO_SHARED)
 
 #define MLD_KECCAK_NROUNDS 24
-#define MLD_KECCAK_ROL(a, offset) ((a << offset) ^ (a >> (64 - offset)))
+#define MLD_KECCAK_ROL(a, offset) (((a) << (offset)) ^ ((a) >> (64 - (offset))))
 
 MLD_INTERNAL_API
 void mld_keccakf1600_extract_bytes(uint64_t *state, unsigned char *data,
@@ -123,14 +121,14 @@ void mld_keccakf1600x4_extract_bytes(uint64_t *state, unsigned char *data0,
                                      unsigned char *data3, unsigned offset,
                                      unsigned length)
 {
-#if defined(MLD_USE_FIPS202_X4_EXTRACT_BYTES_NATIVE)
+#if defined(MLD_USE_NATIVE_FIPS202_X4_EXTRACT_BYTES)
   if (mld_keccakf1600_extract_bytes_x4_native(state, data0, data1, data2, data3,
                                               offset, length) ==
       MLD_NATIVE_FUNC_SUCCESS)
   {
     return;
   }
-#endif /* MLD_USE_FIPS202_X4_EXTRACT_BYTES_NATIVE */
+#endif /* MLD_USE_NATIVE_FIPS202_X4_EXTRACT_BYTES */
   mld_keccakf1600x4_extract_bytes_c(state, data0, data1, data2, data3, offset,
                                     length);
 }
@@ -173,14 +171,14 @@ void mld_keccakf1600x4_xor_bytes(uint64_t *state, const unsigned char *data0,
                                  const unsigned char *data3, unsigned offset,
                                  unsigned length)
 {
-#if defined(MLD_USE_FIPS202_X4_XOR_BYTES_NATIVE)
+#if defined(MLD_USE_NATIVE_FIPS202_X4_XOR_BYTES)
   if (mld_keccakf1600_xor_bytes_x4_native(state, data0, data1, data2, data3,
                                           offset,
                                           length) == MLD_NATIVE_FUNC_SUCCESS)
   {
     return;
   }
-#endif /* MLD_USE_FIPS202_X4_XOR_BYTES_NATIVE */
+#endif /* MLD_USE_NATIVE_FIPS202_X4_XOR_BYTES */
   mld_keccakf1600x4_xor_bytes_c(state, data0, data1, data2, data3, offset,
                                 length);
 }
@@ -188,12 +186,12 @@ void mld_keccakf1600x4_xor_bytes(uint64_t *state, const unsigned char *data0,
 MLD_INTERNAL_API
 void mld_keccakf1600x4_permute(uint64_t *state)
 {
-#if defined(MLD_USE_FIPS202_X4_NATIVE)
+#if defined(MLD_USE_NATIVE_FIPS202_X4)
   if (mld_keccak_f1600_x4_native(state) == MLD_NATIVE_FUNC_SUCCESS)
   {
     return;
   }
-#endif /* MLD_USE_FIPS202_X4_NATIVE */
+#endif /* MLD_USE_NATIVE_FIPS202_X4 */
   mld_keccakf1600_permute(state + MLD_KECCAK_LANES * 0);
   mld_keccakf1600_permute(state + MLD_KECCAK_LANES * 1);
   mld_keccakf1600_permute(state + MLD_KECCAK_LANES * 2);
@@ -491,12 +489,12 @@ __contract__(
 MLD_INTERNAL_API
 void mld_keccakf1600_permute(uint64_t *state)
 {
-#if defined(MLD_USE_FIPS202_X1_NATIVE)
+#if defined(MLD_USE_NATIVE_FIPS202_X1)
   if (mld_keccak_f1600_x1_native(state) == MLD_NATIVE_FUNC_SUCCESS)
   {
     return;
   }
-#endif /* MLD_USE_FIPS202_X1_NATIVE */
+#endif /* MLD_USE_NATIVE_FIPS202_X1 */
   mld_keccakf1600_permute_c(state);
 }
 

data/ext/pqcrypto/vendor/mldsa-native/mldsa/src/fips202/native/aarch64/auto.h

@@ -25,13 +25,15 @@
 /*
  * Keccak-f1600
  *
- * - On Arm-based Apple CPUs, we pick a pure Neon implementation.
+ * - On Arm-based Apple CPUs, or CPUs with MLD_SYS_AARCH64_FAST_SHA3 set,
+ *   we pick a pure Neon implementation.
  * - Otherwise, unless MLD_SYS_AARCH64_SLOW_BARREL_SHIFTER is set,
  *   we use lazy-rotation scalar assembly from @[HYBRID].
  * - Otherwise, if MLD_SYS_AARCH64_SLOW_BARREL_SHIFTER is set, we
  *   fall back to the standard C implementation.
  */
-#if defined(__ARM_FEATURE_SHA3) && defined(__APPLE__)
+#if defined(__ARM_FEATURE_SHA3) && \
+    (defined(__APPLE__) || defined(MLD_SYS_AARCH64_FAST_SHA3))
 #include "x1_v84a.h"
 #elif !defined(MLD_SYS_AARCH64_SLOW_BARREL_SHIFTER)
 #include "x1_scalar.h"
@@ -40,26 +42,30 @@
 #if (!defined(MLD_CONFIG_NO_KEYPAIR_API) ||                                  \
      !defined(MLD_CONFIG_NO_SIGN_API) || !defined(MLD_CONFIG_REDUCE_RAM)) && \
     !defined(MLD_CONFIG_SERIAL_FIPS202_ONLY)
+/* Batched, SIMD-based Keccak-f1600 implementations. */
+#if defined(MLD_SYS_AARCH64_NEON)
+
 /*
  * Keccak-f1600x2/x4
  *
  * The optimal implementation is highly CPU-specific; see @[HYBRID].
  *
  * For now, if v8.4-A is not implemented, we fall back to Keccak-f1600.
- * If v8.4-A is implemented and we are on an Apple CPU, we use a plain
- * Neon-based implementation.
- * If v8.4-A is implemented and we are not on an Apple CPU, we use a
+ * If v8.4-A is implemented and we are on an Apple CPU (or a CPU with
+ * MLD_SYS_AARCH64_FAST_SHA3 set), we use a plain Neon-based implementation.
+ * If v8.4-A is implemented and we are on neither, we use a
  * scalar/Neon/Neon hybrid.
- * The reason for this distinction is that Apple CPUs appear to implement
- * the SHA3 instructions on all SIMD units, while Arm CPUs prior to Cortex-X4
- * don't, and ordinary Neon instructions are still needed.
+ * The reason for this distinction is that Apple CPUs (and other CPUs flagged
+ * via MLD_SYS_AARCH64_FAST_SHA3) appear to implement the SHA3 instructions on
+ * all SIMD units, while Arm CPUs prior to Cortex-X4 don't, and ordinary Neon
+ * instructions are still needed.
  */
 #if defined(__ARM_FEATURE_SHA3)
 /*
- * For Apple-M cores, we use a plain implementation leveraging SHA3
- * instructions only.
+ * For Apple-M cores (and other cores flagged via MLD_SYS_AARCH64_FAST_SHA3),
+ * we use a plain implementation leveraging SHA3 instructions only.
  */
-#if defined(__APPLE__)
+#if defined(__APPLE__) || defined(MLD_SYS_AARCH64_FAST_SHA3)
 #include "x2_v84a.h"
 #else
 #include "x4_v8a_v84a_scalar.h"
@@ -71,6 +77,8 @@
 
 #endif /* !__ARM_FEATURE_SHA3 */
 
+#endif /* MLD_SYS_AARCH64_NEON */
+
 #endif /* (!MLD_CONFIG_NO_KEYPAIR_API || !MLD_CONFIG_NO_SIGN_API || \
           !MLD_CONFIG_REDUCE_RAM) && !MLD_CONFIG_SERIAL_FIPS202_ONLY */
 

data/ext/pqcrypto/vendor/mldsa-native/mldsa/src/fips202/native/aarch64/src/keccak_f1600_x1_scalar_aarch64_asm.S

@@ -10,10 +10,12 @@
 // Author: Matthias Kannwischer <matthias@kannwischer.eu>
 
 /*yaml
-  Name: keccak_f1600_x1_scalar_asm
+  Name: keccak_f1600_x1_scalar_aarch64_asm
   Description: AArch64 scalar implementation of Keccak-f[1600] permutation for single state
   Signature: void mld_keccak_f1600_x1_scalar_aarch64_asm(uint64_t state[25], const uint64_t rc[24])
   ABI:
+    Architecture: aarch64
+    CallingConvention: AAPCS64
     x0:
       type: buffer
       size_bytes: 200
@@ -67,7 +69,7 @@ MLD_ASM_FN_SYMBOL(keccak_f1600_x1_scalar_aarch64_asm)
         .cfi_rel_offset x29, 0x70
         .cfi_rel_offset x30, 0x78
 
-Lkeccak_f1600_x1_scalar_initial:
+Lmld_keccak_f1600_x1_scalar_initial:
         mov x26, x1
         str x1, [sp, #0x8]
         ldp x1, x6, [x0]
@@ -192,7 +194,7 @@ Lkeccak_f1600_x1_scalar_initial:
         eor x14, x26, x6, ror #46
         eor x6, x27, x29, ror #41
 
-Lkeccak_f1600_x1_scalar_loop:
+Lmld_keccak_f1600_x1_scalar_loop:
         eor x0, x15, x11, ror #52
         eor x0, x0, x13, ror #48
         eor x26, x8, x9, ror #57
@@ -305,7 +307,7 @@ Lkeccak_f1600_x1_scalar_loop:
         bic x3, x0, x30, ror #5
         eor x23, x3, x26, ror #52
         eor x3, x29, x30, ror #24
-        b.le Lkeccak_f1600_x1_scalar_loop
+        b.le Lmld_keccak_f1600_x1_scalar_loop
         ror x6, x6, #0x2b
         ror x11, x11, #0x32
         ror x21, x21, #0x14